Email Deliverability for Recruitment Agencies

You can have the right companies, the right hiring manager and a perfectly timed message, and still get nowhere if the email lands in spam. Nobody tells you. No error, no bounce, just silence, until reply rates quietly drop.

Deliverability is the technical and reputational layer underneath your outreach. It decides whether mailbox providers like Gmail, Yahoo and Outlook trust your mail enough to put it in front of a person. Most problems come down to a handful of causes: missing or broken authentication, too many bounces, too many spam complaints, and a domain or IP that has picked up a bad reputation.

This article covers that layer. How to set up domains, inboxes and volume for scale is covered separately in scaling cold email for recruitment agencies.

What is email deliverability, exactly?

Delivery and deliverability are not the same thing. Delivery means the receiving server accepted the message. Deliverability means it reached the inbox rather than the spam folder.

Mailbox providers decide this message by message, based on roughly three questions:

1. Is the sender who they claim to be? That is authentication: SPF, DKIM and DMARC.
2. Does this sender have a good track record? That is reputation, built from bounces, complaints and how recipients engage.
3. Does this message look like something people want? That is content and context, including links and formatting.

Get the first one wrong and the other two barely matter.

SPF, DKIM and DMARC: what do they do?

These three DNS records prove to receiving servers that your mail is genuine. Every domain you send from needs them, including any separate outreach domains.

SPF

SPF (Sender Policy Framework) is a single TXT record listing which services may send for your domain: your email provider, your CRM, your sending tool. The specification limits SPF evaluation to 10 DNS lookups. Agencies that keep adding tools often break that limit without noticing, and the result is an SPF error rather than a pass.

DKIM

DKIM (DomainKeys Identified Mail) is set up in your email provider and published as a DNS record. Google notes that sending to personal Gmail accounts requires a DKIM key of at least 1024 bits and recommends 2048 bits where possible.

DMARC

DMARC ties SPF and DKIM to the domain the recipient sees in the From line, which is called alignment. Its policy can be none (monitor only), quarantine (treat failures as suspicious) or reject (refuse failing mail). A rua address in the record tells receivers where to send aggregate reports, which show who is sending mail using your domain.

A sensible path is to start with a policy of none and a working report address, read the reports for a few weeks, fix any legitimate services that fail, and only then consider a stricter policy.

What do Gmail, Yahoo and Outlook require from senders?

The large mailbox providers have published their requirements, and they are worth reading at the source because they change.

Google (Gmail) requires all senders to set up SPF or DKIM, have valid forward and reverse DNS for sending IPs, use TLS, and keep the spam rate reported in Postmaster Tools below 0.3%. Google's guidelines recommend aiming below 0.1%. Senders of more than 5,000 messages a day to Gmail accounts must additionally use SPF and DKIM and DMARC (a policy of none is enough), align the From domain with SPF or DKIM, and support one-click unsubscribe for marketing and subscribed messages.

Yahoo sets similar rules: SPF or DKIM for all senders and a spam rate below 0.3%. Bulk senders need SPF and DKIM, a DMARC policy of at least none that passes, From domain alignment, and one-click unsubscribe for marketing and subscribed messages.

Microsoft (Outlook.com, Hotmail, Live) announced in 2025 that domains sending more than 5,000 emails a day to its consumer services must pass SPF and DKIM and publish a DMARC policy of at least none that aligns with one of them.

Even well below 5,000 a day, treat the bulk sender rules as your baseline. Meeting them costs very little.

Bounces: why they hurt and how to keep them low

A hard bounce means the address does not exist or the domain cannot receive mail. A soft bounce is temporary: a full mailbox, a server issue, or a provider throttling you. Hard bounces are a direct signal to providers that you are not maintaining your list.

To keep them down:

• Verify addresses before sending and drop anything invalid.
• Remove hard bounces immediately and never send to them again.
• Watch soft bounces. A sudden rise across many recipients at one provider often means you are being rate limited, not that hundreds of mailboxes are full.
• Be careful with guessed addresses. Pattern-based guesses are a common source of bounces for agencies. Our guide on finding contact details for recruitment leads covers better approaches.

Read the bounce messages themselves. Providers often explain the reason in plain text, such as an authentication failure or a reputation block, and that tells you what to fix.

Spam complaints: the number that matters most

When a recipient clicks "report spam", that counts against your domain. Google states the thresholds directly: keep the user-reported spam rate below 0.3%, ideally below 0.1%. Google also notes that Postmaster Tools only counts manual reports, so mail that Gmail filtered to spam automatically is not included and the figure can look better than reality.

What drives complaints for agencies is almost always relevance:

• Contacting people who have nothing to do with hiring.
• Contacting companies that are not hiring at all.
• Sending long sequences to people who never engaged.
• Making it hard to stop receiving messages.

An easy way to stop receiving your emails, and honouring that request across every inbox and campaign, reduces complaints. People who cannot find a way out press the spam button instead.

How do you check whether you are on a blacklist?

Blacklists (also called blocklists) are databases of IPs and domains associated with spam. Many receiving servers consult them. Spamhaus is the best known: its free IP and Domain Reputation Checker at check.spamhaus.org lets you look up an IP address or a domain manually. Its domain list covers the domain and all its subdomains, while IP addresses are checked against its separate IP lists.

If you find a listing:

1. Find the cause first: a bad list, a compromised account, a sudden volume jump.
2. Fix it before asking for removal.
3. Follow the list operator's own process. Spamhaus notes that many listings expire once the cause is gone.
4. Pause outreach from the affected domain until it is resolved.

Do content, links and tracking affect deliverability?

Yes, but less than most people assume, and less than authentication and reputation. A few general principles:

• Keep it plain. Short, mostly text messages look like normal correspondence between people. Heavy HTML, many images and attachments look like marketing.
• Limit links. Each link is another domain that filters evaluate. Link shorteners and domains with a poor reputation are a risk.
• Be thoughtful with tracking. Open tracking usually relies on an invisible image, and click tracking rewrites links through a tracking domain. Both add signals filters look at. Many agencies use them sparingly in cold outreach or turn them off and measure replies instead.
• Avoid sudden changes. Google advises raising volume gradually when you change the format of messages, not just when you start sending.

What should you monitor?

A falling reply rate with unchanged targeting is often the first sign of a deliverability problem. Investigate before you send more, not after.

Getting it right without becoming an email engineer

Poor deliverability quietly wastes every hour you spend on targeting and timing.

If you would rather not manage it in-house, Growth Engine sets up your own domains and senders, warms them up, and sends from isolated infrastructure rather than shared servers used by countless other senders, with scaling and reply management handled for you. For the lead side, LeadFlow delivers companies that are hiring, with the decision maker, into your CRM. You can read more about building that pipeline in lead generation for recruitment agencies.

Key takeaways

• Deliverability means reaching the inbox, not just being accepted by the server.
• Every sending domain needs SPF, DKIM and DMARC; watch the SPF limit of 10 DNS lookups.
• Gmail and Yahoo require a spam rate below 0.3%; Google recommends staying below 0.1%.
• Verify lists, remove hard bounces immediately and make it easy to stop receiving messages.
• Check Postmaster Tools, DMARC reports and blacklists regularly, and act when reply rates drop.

FAQ

Why are my recruitment emails going to spam?

The most common causes are missing or misconfigured SPF, DKIM or DMARC, high bounce rates from unverified lists, spam complaints from poorly targeted recipients, and a sudden jump in volume. Start by checking your authentication records, then your bounce and complaint rates.

What spam complaint rate is acceptable for Gmail?

Google requires senders to keep the spam rate reported in Postmaster Tools below 0.3% and recommends aiming below 0.1%. Yahoo also sets a limit of 0.3%.

Do I need DMARC if I only send a few emails a day?

Google and Yahoo only make DMARC mandatory for bulk senders, but it is cheap to set up and gives you reports on who is sending mail using your domain. A policy of none with a report address is a sensible starting point for any agency.

How do I check if my domain is blacklisted?

Use a lookup tool such as the Spamhaus IP and Domain Reputation Checker, which checks domains and IP addresses against its lists. If you are listed, fix the cause first and then follow the list operator's removal process.